PT-2025-27611 · Nokia · Nokia Single Ran Baseband

Guillaume Teissier + 3 · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-24333

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Nokia Single RAN baseband software versions prior to 24R1-SR 1.0 MP

Description: The issue is related to an administrative shell input validation fault in the Nokia Single RAN baseband software. An authenticated admin user can potentially inject arbitrary commands for unprivileged baseband OAM service process execution by adding special characters to the baseband internal COMA config.xml file. The problem has been corrected in release 24R1-SR 1.0 MP and later by adding proper input validation to the OAM service process.

Recommendations: For versions prior to 24R1-SR 1.0 MP, update to release 24R1-SR 1.0 MP or later to resolve the issue. As a temporary workaround, consider restricting access to the baseband internal COMA config.xml file to prevent potential command injection.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-07980

CVE-2025-24333

Affected Products

Nokia Single Ran Baseband

References · 5

• https://bdu.fstec.ru/vul/2025-07980 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24333 · Security Note
• https://twitter.com/VulmonFeeds/status/1940355756026445978 · Twitter Post
• https://twitter.com/CVEnew/status/1940339414669910425 · Twitter Post
• https://nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24333 · Note